Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cb3d6759 authored by Michal Suchanek's avatar Michal Suchanek Committed by Michael Ellerman
Browse files

powerpc/64s: Enable barrier_nospec based on firmware settings 



Check what firmware told us and enable/disable the barrier_nospec as
appropriate.

We err on the side of enabling the barrier, as it's no-op on older
systems, see the comment for more detail.

Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent 815069ca

arch/powerpc/include/asm/setup.h

+1 −0
Original line number Diff line number Diff line
@@ -52,6 +52,7 @@ enum l1d_flush_type { 


void setup_rfi_flush(enum l1d_flush_type, bool enable);

void do_rfi_flush_fixups(enum l1d_flush_type types);

void setup_barrier_nospec(void);

void do_barrier_nospec_fixups(bool enable);

extern bool barrier_nospec_enabled;

arch/powerpc/kernel/security.c

+60 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 
#include <linux/device.h>

#include <linux/seq_buf.h>



#include <asm/debugfs.h>

#include <asm/security_features.h>

#include <asm/setup.h>
@@ -22,6 +23,65 @@ static void enable_barrier_nospec(bool enable) 
	do_barrier_nospec_fixups(enable);

}



void setup_barrier_nospec(void)

{

	bool enable;



	/*

	 * It would make sense to check SEC_FTR_SPEC_BAR_ORI31 below as well.

	 * But there's a good reason not to. The two flags we check below are

	 * both are enabled by default in the kernel, so if the hcall is not

	 * functional they will be enabled.

	 * On a system where the host firmware has been updated (so the ori

	 * functions as a barrier), but on which the hypervisor (KVM/Qemu) has

	 * not been updated, we would like to enable the barrier. Dropping the

	 * check for SEC_FTR_SPEC_BAR_ORI31 achieves that. The only downside is

	 * we potentially enable the barrier on systems where the host firmware

	 * is not updated, but that's harmless as it's a no-op.

	 */

	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&

		 security_ftr_enabled(SEC_FTR_BNDS_CHK_SPEC_BAR);



	enable_barrier_nospec(enable);

}



#ifdef CONFIG_DEBUG_FS

static int barrier_nospec_set(void *data, u64 val)

{

	switch (val) {

	case 0:

	case 1:

		break;

	default:

		return -EINVAL;

	}



	if (!!val == !!barrier_nospec_enabled)

		return 0;



	enable_barrier_nospec(!!val);



	return 0;

}



static int barrier_nospec_get(void *data, u64 *val)

{

	*val = barrier_nospec_enabled ? 1 : 0;

	return 0;

}



DEFINE_SIMPLE_ATTRIBUTE(fops_barrier_nospec,

			barrier_nospec_get, barrier_nospec_set, "%llu\n");



static __init int barrier_nospec_debugfs_init(void)

{

	debugfs_create_file("barrier_nospec", 0600, powerpc_debugfs_root, NULL,

			    &fops_barrier_nospec);

	return 0;

}

device_initcall(barrier_nospec_debugfs_init);

#endif /* CONFIG_DEBUG_FS */



ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)

{

	bool thread_priv;

arch/powerpc/platforms/powernv/setup.c

+1 −0
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ static void pnv_setup_rfi_flush(void) 
		  security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV));



	setup_rfi_flush(type, enable);

	setup_barrier_nospec();

}



static void __init pnv_setup_arch(void)

arch/powerpc/platforms/pseries/setup.c

+1 −0
Original line number Diff line number Diff line
@@ -534,6 +534,7 @@ void pseries_setup_rfi_flush(void) 
		 security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR);



	setup_rfi_flush(types, enable);

	setup_barrier_nospec();

}



#ifdef CONFIG_PCI_IOV